Network information can be split up into units of information called packets. Typically, the packets are routed dynamically between and within networks based on an efficient route between the source of the packet and the destination of the packet. Each packet typically contains a header that includes source and destination information for routing the packet and a data payload including typically a portion of the information being transmitted.
When a packet enters a network or system from an external source the packet can be examined. The examination may include determining where the packet should be routed, but also can include processing the packet to evaluate possible threats posed by the packet to the network. Different packet processing devices can be used to examine packets, for example, some packet processing devices target specific portions of a packet.
In a conventional network model, different packet processing devices can be designed to examine different layers within a packet. For example, a layered network model called the Open Systems Interconnect (OSI) model has been created by the International Standards Organization (ISO). The OSI model describes defined layers in a network operating system. Each layer has a defined input, output, and function. The OSI model defines a seven layer network and includes network and transport layers (layers 3 and 4, respectively) and an application layer (layer 7).
One type of packet processing device is a firewall. A firewall can be used to secure a network from users outside the network. The firewall checks, routes, and frequently labels all messages sent to or from users outside the network. Another packet processing device, such as an intrusion detection system, can be used to examine information being communicated with a network to recognize suspicious patterns of behavior. Information obtained by the intrusion detection system can be used to block unauthorized or disruptive users from accessing the network.
A flow-based router (FBR) allows network administrators to implement packet forwarding and routing according to network policies defined by a network administrator. FBRs allow network administrators to implement policies that selectively cause packets to be routed through specific paths in the network. FBRs can also be used to ensure that certain types of packets receive differentiated, preferential service as they are routed. Conventional routers can forward packets to their destination address based on available routing information. Instead of routing solely based on the destination address, FBRs enable a network administrator to implement routing policies to allow or deny packets based on several other criteria including the application, the protocol, the packet size and the identity of the end system.
A packet filter can operate on the packets in the network layer, to defend a trusted network from attack by an untrusted network. Packet filters can operate at the network layer to inspect fields of the Transmission Control Protocol/Internet Protocol (TCP/IP) header including, the protocol type, the source and destination Internet Protocol (IP) address, and the source and destination port numbers.